D:\VisualStudio\Windows\AppLication\VC新版登录器\注册后台\x64\Release\RegistrAtion.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5011a22747641853ece826e7b32d929d90aecfcaf6cac67e78535a80bd2b3d0b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5011a22747641853ece826e7b32d929d90aecfcaf6cac67e78535a80bd2b3d0b.exe
Resource
win10v2004-20240802-en
General
-
Target
5011a22747641853ece826e7b32d929d90aecfcaf6cac67e78535a80bd2b3d0b
-
Size
4.2MB
-
MD5
f629260021d02f72869ae0283c46ec24
-
SHA1
84f8f53e62dc0843e650c32b624e28e3dc0db82b
-
SHA256
5011a22747641853ece826e7b32d929d90aecfcaf6cac67e78535a80bd2b3d0b
-
SHA512
ee821194d4c5e3099e1843563c56a0a55d8c221035645850db98cdb4b9d1c95712864338b27e1cb053042b37dcdd4a653d40fe8c55601945a8891893f3f367e8
-
SSDEEP
98304:7FcHkwtztO4k3h1IIm3oNyAmJL7sOsxjD0:7FcHRztOnIIIoxmJwxjD0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5011a22747641853ece826e7b32d929d90aecfcaf6cac67e78535a80bd2b3d0b
Files
-
5011a22747641853ece826e7b32d929d90aecfcaf6cac67e78535a80bd2b3d0b.exe windows:6 windows x64 arch:x64
1fa2c9277c19fe49a2de4c41ae0bbcfb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
FreeEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSysColor
gdi32
SetTextColor
advapi32
CryptAcquireContextA
comctl32
ord17
ws2_32
getsockname
shlwapi
StrChrA
Exports
Exports
PN��d�R�}D#�ne}"��d��4n ��s38/>6JX���C�r��*���k5�2�L����v�V[ �g�&��}�:�T��\��k4�3�?/M�?�S�<��b��:��y)�$���|�.��O�=^攄��, G�0�b�[�S�C˧�z�O~�(H|�=Ow ���,����� �Qż��ڿ��hS|;o��&�}��C!��R_���f����D(�*=�?ꓖK�رΉG̓�yo�W̑l,ٿH/���U�]����X:������[����ɓ��ޡRކ��Ђ�m�b>�d��T��,`�L<Au�����w6�N�;:ӷd=�P�^-,}g/ s�m@���������/~Y^X���U8���.�*���E.�a�Ӌ/���v%������BBK�}1��-#4�г9Xê��dC&��9$M�rK�(/�O��d&��=�Ĺ��X�UU�В<ku��B���-OMn���j�:�v�ݐ�=�EB�}�B'�S�T�q��a�_:v��%D���ۇ���1�A��ŝ�ɰf㕘mH�,I'�jB쥁��� |W�� 0�qX�Y?&*>o�BQ�d�G�8�������)Qr�����*� ���c�"+d2^��ލ ����&}���K�+��}w%�$I���MÏg:���xX�������'[ib��.�1rlS'�|H��FE�L�2���L�|*&M+k\L��n�\<�Ƭ��Z��};6��_�^����uG�ki�>�ո��B�6�'��i֥Cф���Y�[�]A�HYD9�Uǚ�Y�#{��w��������B��]-&H�e�h���)�$�9a4v� tA0�'#>>=��<�\c�)��:�,&L~���JƥO |�������pke3���Ǻ�O4s�B�^H������GQ��Ʋr���]kG�-���>�E�l��xa���vlH�Hg0���=a��<�f� �p=?&�!�"�s�(����W�cX"9{Y���!m�˿�sLj�Y���� - <U��3�h��Zz��8�j�Aw�VZD��y�V,�SM�C+���������0� �Y��J]��َ�u�b�"AZW�ɂ��,�gJ��+^���K�]�Bϊ�E����);��e��i��(E �3}���P�� �$��[�sj�1"e��yX�Jter5 twJqullսfJ�*��j������q<��ʸ^NW����$k�ZѸX�K�Y`�у#9��K {\f���h�P2c:����0�ۢ���2S��ذ�8ͳH�tL��ד��cQl&�5���3!�g� ��u��tN?+�k���%�=i��2��۪&�ځ��$�gz�r����i:>*�����S���]��Ui�uk��26��Ƥ(�(���A^���,�~��vi_��wRڙ��*�\�����~����D�ն�� |� �ZQ uvt�1��Nʖ���@���5#�7I���L�i�E�G�$Z����AS$G��Ε5Z�qE��n��W�O"��%�}��V+{��m �+�Wo�8����w��Y��Y�i@y�8���,mJ�j�#����z�=����8!{u� �[�z_��$�����h�`��fa\��E�ҽ�~'N$��e�����v�t�BF�wp�^��x���S��͍h�[�zc�Zff���@�����Ft��i�wT�!�s��J)�^u��d��M��VB�e%W��x��9K#��� 娍��+�u�[��O����f��*n��ƶ)�<���^@��ؐ�0[Z���BWge�Z�K�Ȯy�E�V���kџ��� ��"3�Q�E�����Z��%���=��N�Ei�[���!B����o%��j0��J����%,��� 礠h8�)�3xgz`��f�Z��$��~I����[��AJ<�2@ h��嵚?{����:'�u���nנ��b�s�����,��d��I�yU�|�0 R�Eɏ�M5��6r@���G7_�G����� +��&�d{E�Ȕ��ζ�T�V(lO��qz �$B+�k�:S���} =[?�9#����S�ݳu�g�i7����F�yy;�- ��D1��Cp�����y�G���0�}�W��;�/")�a�nK^M��C<��?�b����ݘ�7ڐ���g�y��M��%������s�~7�X��m�efsh���7���ښ:��I�M^&��̩��[M���?'���z���k��y�P���øMc���9�3푱=�2�R��*II$x�/���Wa��9psҽu��q1I&�u�pk!�j�r�����Q�<�P_������!f�� �n|�c�_��.lz��2�>uK�X�Wp��HVz� W�`����!�|3͚�ڕUp��6U�!"�*��UC3����]v'�q��������Z�a���4 ~��(@g:TVI���a-fjca.�[�F��� 5���PmjS*2q�{�{�R6'�x@�/_-���������'�tr��?�����C0���SW��υ�gi���.��>�90D��� �Z�%8��@�߾`BX���kӂU���k���q��97�WKr�$ *kd�e t��)J�-4}������+0{�����j�^�`ʑ�_��"��.����]����C����0�cXBo����$L�F��Kջ��3�l�j�+ �`�\=�<����N����dV�N���h'5h�;d�ڒ���p��ǯ}��C�~��&�eK&Xb�4 �;k�a%��yM�/u��G�7�58v\��h��ܵ��f�wCbX p��%�y�a�p����'����#��ѹ�_�����܇u���\o���UwfJ����E�_�O-ل�pLƖ�3���Ǒ���ʷ��ŋ_��+�[7�����Y����ܘ����s�Ϙ[��콥��Ë����A��Nv<y;͛��m��$ѭ��ƚ���d�=�. �Y�b����Â,� �g�)u寧���>����X��Xԇ5)�c�`ֆ��3�q^����������l�!V��5�^����� 1���|��j(�a��Ԉ3A�c+1�^E
Sections
.text Size: - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 167KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ